CVE-2026-91102: HP Linux Imaging and Printing RCE Vulnerability

CVE-2026-91102 Overview

HP disclosed multiple vulnerabilities in HP Linux Imaging and Printing (HPLIP) software that allow local attackers to execute arbitrary OS commands. The flaws span several HPLIP components and, depending on the code path, can enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. The primary weakness is classified as [CWE-78] Improper Neutralization of Special Elements used in an OS Command (OS Command Injection). Exploitation requires local access and user interaction on the affected host.

Critical Impact

A local attacker who can trigger vulnerable HPLIP code paths can execute arbitrary commands with high impact to confidentiality, integrity, and availability of the affected system.

Affected Products

• HP Linux Imaging and Printing (HPLIP) software suite
• HPLIP components handling print, scan, and device management on Linux distributions
• Systems where HPLIP is installed alongside HP printing and imaging devices

Discovery Timeline

• 2026-09-16 - CVE-2026-91102 published to the National Vulnerability Database
• 2026-09-17 - Record last modified in NVD

Technical Details for CVE-2026-91102

Vulnerability Analysis

HPLIP is HP's open-source driver and utility suite that provides printing, scanning, and device management on Linux. The advisory groups multiple externally reported issues under a single bulletin. The dominant weakness is OS command injection [CWE-78], where untrusted input reaches a shell or command invocation without adequate neutralization.

Because the attack vector is local and requires user interaction, exploitation typically involves an authenticated user invoking a vulnerable HPLIP utility with attacker-influenced input. Successful exploitation yields code execution in the context of the invoking process, which in many HPLIP workflows runs with elevated privileges tied to printing subsystems or device access groups.

Root Cause

The root cause is improper neutralization of special shell metacharacters in arguments passed to OS command invocations within HPLIP components. When user-controllable data such as device URIs, file paths, or configuration parameters is concatenated into shell commands, characters like ;, |, &, backticks, and $() are interpreted by the shell instead of being treated as literal data.

Attack Vector

A local user triggers a vulnerable HPLIP utility, script, or setup workflow with crafted input. The malicious payload embeds shell metacharacters that break out of the intended argument context. When HPLIP passes the string to a shell for execution, the attacker's commands run with the privileges of the calling process. Refer to the HP Security Bulletin for component-specific details.

No verified public exploit code is available for CVE-2026-91102 at the time of publication. The vulnerability mechanism follows the standard OS command injection pattern where unsanitized input flows into a shell execution primitive.

Detection Methods for CVE-2026-91102

Indicators of Compromise

• Unexpected child processes spawned by HPLIP binaries such as hp-setup, hp-plugin, hp-check, or the hpcups filter
• Shell interpreters (/bin/sh, /bin/bash) invoked as children of HPLIP Python scripts under /usr/share/hplip/
• New or modified files in printer spool directories or user home directories following HPLIP utility execution
• Outbound network connections initiated by HPLIP processes that do not correlate with legitimate driver downloads

Detection Strategies

• Monitor process execution telemetry for HPLIP components spawning unexpected shells, interpreters, or system utilities such as curl, wget, nc, or python
• Alert on HPLIP processes writing to sensitive locations including /etc, /usr/local/bin, or cron directories
• Correlate user-invoked HPLIP commands with subsequent privilege changes or SUID binary creation

Monitoring Recommendations

• Enable Linux audit rules (auditd) on HPLIP binaries and configuration files to capture argument strings passed at execution time
• Ingest endpoint process telemetry into a centralized data lake to hunt for command injection patterns such as shell metacharacters in HPLIP arguments
• Review CUPS and HPLIP log files for anomalous device URIs or configuration values containing shell metacharacters

How to Mitigate CVE-2026-91102

Immediate Actions Required

• Apply the patched HPLIP release referenced in the HP Security Bulletin as soon as it is available for your distribution
• Inventory Linux hosts with HPLIP installed and prioritize multi-user systems, print servers, and workstations with elevated print group membership
• Restrict interactive access to systems running HPLIP to trusted users until patches are deployed

Patch Information

HP has remediated the reported vulnerabilities in updated HPLIP releases. Consult the HP Security Bulletin for the specific fixed versions and component-level guidance. Linux distribution maintainers typically publish backported HPLIP packages through their standard security update channels.

Workarounds

• Remove or disable HPLIP on hosts that do not require HP printing or scanning functionality
• Constrain membership of print-related groups such as lp and lpadmin to reduce the population of users who can invoke HPLIP utilities
• Enforce mandatory access controls using AppArmor or SELinux profiles that restrict HPLIP binaries from executing arbitrary shell interpreters or writing outside expected directories

# Configuration example: verify installed HPLIP version and remove if unused
hp-check -r
sudo apt list --installed 2>/dev/null | grep -i hplip
sudo apt remove --purge hplip hplip-data && sudo apt autoremove